6 ms·

Why is that scary? If you do bad things, you're going to get banned. This guy abused Github to distribute malicious code to thousands of projects. If losing yo

• thr0wawayf00 5y ago
  > This guy abused Github to distribute malicious code to thousands of projects. He could've done far, far worse in terms of the technical impact of these changes. It's obvious that he was trying to make a statement, not exfiltrate data to sell on the dark web. It's scary because, as a FOSS maintainer, your code is your responsibility to do with what you will until it's no longer in the market's interest. You don't have the right to expect any sort of compensation for it, but if your project somehow becomes successful and you upset the natural order, all of the work you were told belongs to you that you should be grateful is so successful without being compensated for is now no longer under your control. There was never a business relationship to sever in the first place. The market doesn't want to come up with a way to compensate FOSS developers with high-profile projects like these, yet the general expectation is those individuals should just continue working on these libraries for companies to profit off of them. I wouldn't have handled this situation the way this person did, but we're reaching this point where legitimate protest and speech is being met with erasure and confiscation of your work, and that should scare everybody. > This guy abused Github to distribute malicious code to thousands of projects. That's one way to look at it. An alternative view is that a bunch of companies took some free code and shoved it into their apps and then got mad that the free code is causing them problems. Instead of examining the inherent contradictions of the FOSS community, commercial interests would rather just erase the protestor.
  • not2b 5y ago
    This wasn't a "protester". It was deliberate sabotage, done with full knowledge that it would cause major damage. GitHub is with its rights to kick this guy off. It would even be within its rights to take over that account and fix the introduced bug (by reverting the change or otherwise). That wouldn't prevent the original developer from maintaining their own broken version, but npm and GitHub could eliminate it if they want.
    • thr0wawayf00 5y ago
      > It was deliberate sabotage, done with full knowledge that it would cause major damage. That's how protesting often works. Deliberately interfering in normal affairs is a very common protest tactic. Just look at the interstate shutdowns after the George Floyd killing, or going back to Rosa Parks and the Montgomery bus boycott, worker strikes, etc. etc. That's exactly how protest works. Forcing application code to print statements like "LIBERTY LIBERTY LIBERTY" is very, very different than trying to infiltrate commercial systems and exfiltrate sensitive data.
      • zamadatix 5y ago
        Protesting in that manner isn't without consequence even if the thing being protested for is right or something else is worse to do. "It was in protest" is a reasoning not an absolution.
        • pritambaral 5y ago
          And who decides the consequences? Who executes the sentence? What makes GitHub the judge, jury, and executioner?
          • zamadatix 5y ago
            The entity doing the hosting gets to decide what it wants to host. In this case that is GitHub. For the other consequences it depends on the action, where it took place, and what it resulted in to find who assigns and administers the consequences.
        • thr0wawayf00 5y ago
          I'm not arguing that there should be no consequences for what this person did. I am questioning the ability for an application like Github to essentially "cancel" someone like this whenever they feel like it.
          • zamadatix 5y ago
• vultour 5y ago
• godDLL 5y ago
  "Abused Github to distribute malicious code" is a legal wording, not a EULA violation. A lawsuit, not an account ban. Let's decide how serious this is. Exactly. I am, for one, of the opinion that it is not at all serious. Not deserving of a lawsuit or an account ban. Not even newsworthy. I mean, this could easily become the new normal for OSS. You use it – you're not insured against anything, for there is no formal contract.
  • heartbreak 5y ago
    You don’t need a contract to be protected against intentional harm.
    • godDLL 5y ago
      In a society. Hence, "social contract". There is no Zuckerverse contract.
  • viro 5y ago
    no its a criminal act. crashing RANDOM servers that you DONT know what they do is not a protest.
    • nathanaldensr 5y ago
      Your argument could be used to describe any software defect, whether malicious or accidental. Open-source code is mostly not produced with any knowledge of downstream servers; that's the responsibility of the server owners. The software developers also have a responsibility to ensure they trust the author and are okay with the code they are importing into their own projects.
      • viro 5y ago
        No it only describes malicious intent which IS required for it to be malware aka criminal.
        • 5y ago
• tjpnz 5y ago
  Where do you draw the line? I've learned the hard way that SemVer isn't universally respected in the Node ecosystem. What happens if the maintainer of a sufficiently popular package decides to push out a patch release overhauling the public facing API? Does Github ban them too?
  • saltminer 5y ago
    I'm reminded of Mongoid, which was at one point using SemVer, but stopped, and at least one company was caught off guard by breaking changes in (seemingly) minor releases (https://news.ycombinator.com/item?id=29845724 https://news.ycombinator.com/item?id=29845724).
    • dudeinjapan 5y ago
      Am working with Mongoid team to get them to use semver again. There is hope yet.
• oauea 5y ago
  What's actually malicious about the code? It's an infinite loop that logs to stdout. Sure, it's not what the library is supposed to do, but is it malicious code?
  • fault1 5y ago
    I think the intention is to cause downstream users to spinlock.
    • oauea 5y ago
      It might be, but this is not malicious. Plenty of projects have pushed breaking changes for one reason or another. I'd argue the only malicious actors here are those who do not pin and test their dependencies before shipping updates.
• everforward 5y ago
  The counter-framing is this guy updated his project and thousands of projects chose to pull that update. He didn't go around submitting PRs to update the version of this. He didn't deploy anything into production. You have the right to use the code for free, and he has the right to do terrible things with his code. If you don't like that arrangement, get him to sign a contract that includes responsibilities on his part like not shipping intentionally broken packages. Or get your distribution from someone that does have a responsibility to you. I probably wouldn't do the same in his position, but I still support his (moral) right to do what he did. It's his project, and he can tank it if he wants to. Just like if I had a business, I could tank it if I wanted to. It's probably not a wise thing to do, but it is something I could do.
• young_unixer 5y ago
  > If you do bad things, you're going to get banned No, that's not what the TOS says. In the same way that being an asshole isn't illegal, doing "bad things" is not against the TOS. > This guy abused Github to distribute malicious code to thousands of projects. 1. AFAIK he didn't abuse Github. He used the typical method of uploading code, into his own repo. 2. He didn't distribute the code, that was npm. 3. The code being malicious is your interpretation. Can code not contain political or nonsensical messages? I think people should be free to share code with political messages, or with nonsense if they want.